Explaining the GitHub DDoS Attack

John outlines the details of the DDoS attack that targeted the popular GitHub website. It was the largest DDoS attack ever in recorded history. The attackers used a known vulnerability of memcached servers to launch an amplification attack at GitHub. The attack lasted about 20 minutes, but GitHub successfully defended it. The attack vector used by the attackers still exists today, so the attack could be launched again with relative ease. Be sure to watch the video to learn about the attack and how to defend against it.
More info here on DevCentral: community.f5.c...

[@rakesh2639]

The way of explaining is really good, thanks John to published the knowledgeable article.

[@devcentral]

glad you enjoyed it!

[@deaconfelix7539]

Sorry to be off topic but does someone know a tool to log back into an instagram account?
I stupidly lost the account password. I would appreciate any tips you can offer me.

[@ytbcmt4686]

BTW, Akamai was the company which fended off the largest DDoS attack in history!

[@winzony]

Nop Arbor networks 1.7 Tbps

[@samlaf92]

Is a scrubbing center just a "large pipe" that can handle the temporary traffic spike?

[@devcentral]

pretty much but you also need the intelligence/software/etc to be able to pick out the bad stuff and let through the good.

[@kieranriordan1908]

great video, broke it down well for a beginner to understand, thank you!

[@sak2029]

Short and crisp.. Very informative..

[@devcentral]

glad you enjoyed it!

[@vengalachandu4080]

Superb ..thanks john

[@devcentral]

glad you enjoyed it!

[@tdibandara3478]

Very clear and informative, thank you

[@devcentral]

glad you enjoyed it!

[@saqibmehmood1223]

Very Informative video!

[@devcentral]

glad you enjoyed it!

[@digitzero3613]

Instructions were not clear, I forgot to spoof my IP

[@dashdashdash_]

I actually use the ping function i find it very handy the other day i knocked of the government because they r bad ppl and then i didded a game serverice so let me know in the comments if this tutorial helped you.

[@rakesh2639]

Good explanation, ultimate knowledgeable person, thank a lots for sharing video

[@devcentral]

glad you enjoyed it!

[@carolinemathieson]

John, can you write backwards or am I seeing a mirror image of you?

[@devcentral]

Hi Caroline...great question! We flip the image after recording, so it's a mirror image. I wish I could write backwards that well, though!

[@0ttt3R]

I had to re-watch the first 5 mins of the video because I was trying to figure this out - you'll notice he appears to be writing from right to left in the video ;)

[@jackoe1246]

Such a simple tool gives such a great solution! Cool video!

[@s2korpionic]

@@devcentral Wait... so that Dev Central logo is also backwards?

[@larrymckeithan7308]

@@devcentral How do you keep the logo on your shirt from being flipped as well?

[@EdeYOlorDSZs]

very clear, thanks!

[@devcentral]

Glad you enjoyed it and we appreciate the comment!

[@munhumutapa1330]

Great illustration, thank you.

[@devcentral]

glad you enjoyed it!

[@deadchannel3]

Memcrashed, very powerful, but after testing the severs, the amplification factor isn’t to great. Even if some one is getting attacked they can flush all memcrashed servers stopping the attack. Note: NTP amplification has a amp factor of more than 2000 with a good server.

[@stunnacid]

Great video keep it up!

[@devcentral]

glad you enjoyed it!!

[@epicisdan]

Clear and informative video. Subscribed

[@devcentral]

thanks...glad you enjoyed it!

[@sebon11]

Great explanation, thank you. There are few things that I totally can't understand, like how can someone from outside change the server limit. Can you do that by knowing ip address of some memcached server? It's THAT easy? I don't think so. I just don't get it, there must be some system that allows only administrators to do it. But that's just little unclear part, generally this explanation was great, thx alot!

[@devcentral]

Great question Sebastian...and sorry for the very late response on this. I briefly mentioned that someone could change the memory limit on the memcached server, but it's true that changing the configuration of the memcached server would require that someone has gained access to that server (hacked it). So, while open memcached servers are easy targets for launching DDoS attacks, the specific part about changing the configuration of the memory size limits is a bit more involved. You would need to modify the /etc/sysconfig/memcached file to change the CACHESIZE limit. Here's an example of that file:
# vi /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
# max connection 2048
MAXCONN="2048"
# set ram size to 4096
CACHESIZE="4096"
# optional config: i.e. disable UDP and listen to loopback ip 127.0.0.1, for network connection use real ip e.g., 10.0.0.5
OPTIONS="-U 0 -l 127.0.0.1"

[@nmestre2]

Thank you :)

[@devcentral]

Glad you enjoyed it!

[@simonjohn8374]

Amazing explanantion

[@devcentral]

glad you enjoyed it!

[@spicace]

Why accept UDP into the DMZ ?

[@sylvesterobioha1030]

Simplicity played out! weldone!

[@devcentral]

glad you enjoyed it!

[@web2yt488]

Playback speed 1.5x

[@corbenreed6724]

Thanks Peyton Manning!